JP — ITmedia

Joshin Unauthorized Access May Have Leaked Up to 6.23 Million Records, Including 2 Driver's Licenses and 1 My Number Card

SecurityOctober 26, 20261 min read

Joshin, a Japanese electronics store chain, says up to about 6.23 million customer records may have leaked after a hacker broke into its network. The company says the leak is not yet confirmed.

What happened

Joshin, which runs the electronics store Joshin and also does home renovation work, found unauthorized access to its network. It announced the problem on October 17. On October 26, it said that up to about 6.23 million member records may have leaked. The data may include names, addresses, driver's license images, My Number card information, and login details. The company is still checking how far the problem goes and whether data really leaked.

Key numbers

Up to about 6 million records from the member information database server, including names, addresses, phone numbers, and member numbers.
Up to about 230,000 records from the subscription service "Joshin Subscription," including login IDs, initial passwords, billing history, and device IDs.
Up to about 800 records from the renovation photo upload system, including 2 driver's license images, 1 My Number card, and 5 bank account numbers.
The company says it does not keep credit card information.
The problem was first found on October 16.

How the problem was found

On October 16, Joshin noticed a strange problem in its network. When it looked into it, it found signs that someone had broken in, in some parts of the system. The company shut off the affected servers and asked outside experts to investigate. Some services are still not available because of this.

Why it matters

Leaked personal data can be used for scams. Joshin warns customers that fake emails, text messages, or phone calls that pretend to be from the company may arrive. Customers should be careful about messages asking for personal information or money, and should not click unknown links.

What to watch

Whether Joshin confirms that data actually leaked, and how many people are affected.
When the stopped services will start working again.
What the outside experts find about how the attackers got in.
Whether affected customers are contacted and given help.

Glossary

Joshin: A Japanese electronics store chain that also runs home renovation services and a subscription service.
My Number card: Japan's national ID card that holds a personal number and identity information.

Microsoft releases emergency .NET security fixes for Google Brotli bug

Microsoft has issued an out-of-band security update for .NET 8, 9, 10, and 11 to patch a buffer overflow in Google's Brotli compression library, tracked as CVE-2026-111497 and rated 8.1 under CVSS v3.1. The flaw could let an unauthenticated attacker read or corrupt process memory, leading to information disclosure, denial of service, or elevation of privilege. Microsoft's advisory says exploitation is "More Likely," though it found no evidence yet that criminals are using working exploits in attacks.

SecurityITmediaOct 26

Customers to Sue Times Car Operator Over Data Leak, Lawyer Announces at Press Conference

Attorney Yuki Makino, who set up a class-action website, announced at a Tokyo press conference on October 26, 2026 that he will file a lawsuit at the Tokyo District Court against Park24, which operates Times Car, and its executives, seeking 30,000 to 50,000 yen per victim in damages. The suit follows a leak of up to about 6.6 million members' personal information, including driver's license images, after unauthorized access detected on September 25; more than 100,000 people have registered on the site.

Security전자신문Oct 26

Cyber Intrusions Spread to Insurers, Software and Travel Sectors as Financial Sector Breaches Mount

Mirae Asset Life Insurance reported a suspected personal data leak after detecting abnormal activity and notifying the Financial Supervisory Service, marking the insurance sector's first reported intrusion. Separate breaches hit enterprise software firm Douzone Bizon, which is investigating a possible leak of external partner and client employee data tied to a suspected zero-day flaw in backup software, and travel platform NOL, which confirmed leaked data from domestic accommodation booking customers. KB Kookmin Bank said the number of affected people in its earlier breach rose to 2,210 after 2,091 more were identified.